The situation
Six weeks before a national vote, the country's electoral integrity body noticed a surge of accounts presenting as ordinary local voters, all amplifying the same claims about postal ballot fraud across major social platforms. Some posts were reaching millions of views. Journalists were beginning to report the claims as a groundswell of public concern.
The body had a delicate problem. It needed to know whether this was organic worry, domestic activism or something else entirely, without becoming a participant in political debate itself. Whatever it said publicly would be scrutinized by every side.
The question
Is this activity coordinated? If it is, who is running it and how large is it? And is there enough evidence, presented in the right form, for platforms to enforce their own policies against it?
What we did
A lead influence operations analyst, four analysts, three native-language linguists and a data engineer worked the case, with a red-team reviewer assigned throughout. Our approach to separating networks from crowds is described in detail in Seven signals that separate a network from a crowd.
1. Expanded from a seed set, with a high bar for inclusion
We started from 120 accounts flagged by the client and expanded by co-amplification: accounts that repeatedly shared the same content within minutes of each other. To protect genuine users who simply agreed with the claims, no account entered the network unless it showed at least three independent coordination signals.
2. Measured the coordination signals
- Creation dates. 1,140 of the accounts were created inside two windows of nine days each, eighteen months apart.
- Profile images. 61 percent used recycled stock photographs or synthetic faces carrying consistent generation artifacts around the ears, teeth and background.
- Posting schedule. Activity followed a working day five hours offset from local time, with a lunch-hour dip and almost no posting at weekends.
- Content. 74 percent of posts were built from 46 text templates with minor word substitutions.
- Language. Native-language linguists identified errors in idiom and dialect consistent with non-native writers using machine translation.
3. Followed the operation off-platform
Shortened links in the posts resolved through a link-tracking account that was also used by other clients of a commercial content agency. The agency's own public portfolio advertised "audience growth for political clients". Job advertisements it had posted sought social media operators fluent in the target language, with shift hours that matched the network's posting schedule to within the hour.
4. Challenged the attribution
The red-team reviewer tested the most credible alternative: that these were real members of a diaspora community, coordinating openly around a shared concern. Genuine diaspora accounts would have long histories, personal content and visible real-world ties. The network accounts had none of these, and their creation dates fell inside the same two windows.
| Signal | Organic crowd | This network |
|---|---|---|
| Account age | Spread over years | Two nine-day creation windows |
| Activity rhythm | Evenings and weekends | Office hours, five hours offset |
| Profile content | Personal, varied | Stock or synthetic faces, no history |
| Wording | Individual phrasing | 46 templates with substitutions |
| Off-platform links | Diverse sources | One agency's tracking account |
What we found
- High confidence: 1,900 accounts formed a single coordinated inauthentic network.
- High confidence: the network was operated by a commercial content agency based outside the country.
- Low confidence: the identity of whoever commissioned the agency. Open sources did not establish who paid for the campaign, and we reported that gap explicitly rather than speculate.
We did not attribute the campaign to any government, party or candidate. The evidence identified the operator, not the customer. Saying so plainly is what allowed the electoral body to publish our findings and defend them under scrutiny from every side.
The outcome
We delivered referral packages to three platforms, each containing the account list, the coordination evidence for every account and preserved copies of the content. We formatted each package against the platform's own published policy on coordinated inauthentic behavior.
- Within 72 hours, platforms removed 1,640 accounts. The remainder were restricted or placed under review.
- The electoral integrity body published a public attribution report based on our findings 16 days before the vote.
- The network's daily reach fell by more than 90 percent over the final fortnight of the campaign.
- Continued monitoring through election day detected two attempts to rebuild the network. Both were reported and removed within a day.
What made the difference
The three-signal threshold protected real voters from being swept into the network, which protected the credibility of everything else we reported. Packaging the evidence against each platform's own policy language meant enforcement teams could act without redoing the analysis. And being explicit about what we could not establish made the public report harder, not easier, to attack.